# Audit Dependencies

> Dependency audit across the service repositories.

- Skill: `stbenjam/audit-dependencies` (Agent Skill)
- Install (CLI): `npx skillmds@latest add stbenjam/audit-dependencies`
- Raw SKILL.md: https://api.skillmd.com/api/skills/stbenjam/audit-dependencies/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: stbenjam (https://skillmd.com/u/stbenjam)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/stbenjam/audit-dependencies

---


# Audit Dependencies

Reports which services pull a vulnerable or unmaintained dependency, and
which of those are reachable from a request path.

## Running the audit

`depaudit scan --org platform` writes one JSON report per repository. The
shape of that report is documented in [the report
schema](docs/depaudit-schema.md).

## Reading the results

Reachability matters more than the raw CVE count. A vulnerable parser that
runs only in a build script is not the same risk as one in the request
path — see [the triage rubric](docs/reachability.md).

File one issue per reachable finding, using [the issue
template](templates/security-issue.md).